Page History

...

Compliant Solution (Windows)

Wiki Markup
Microsoft Visual Studio 2005 provides provides the

((

 {{_dupenv_s()}} and {{_wdupenv_s()}} functions for getting a value from the current environment.  \[[Microsoft Visual Studio 2005/.NET Framework 2.0 help pages|http://msdn2.microsoft.com/en-us/library/ms175774(VS.80).aspx

^{Image Removed}

]\].

The _dupenv_s() function searches the list of environment variables for a specified name. If the name is found, a buffer is allocated, the variable's value is copied into the buffer, and the buffer's address and number of elements are returned. By allocating the buffer itself, _dupenv_s() provides a more convenient alternative to getenv_s(), _wgetenv_s().

...

Code Block

bgColor	#ccccff

char *tmpvar = strdup(getenv("TMP"));
char *tempvar = strdup(getenv("TEMP"));
if (!tmpvar) return -1;
if (!tempvar) return -1;

if (strcmp(tmpvar, tempvar) == 0) {
  puts("TMP and TEMP are the same.\n");
}
else {
  puts("TMP and TEMP are NOT the same.\n");    
}

Wiki Markup

If an environmental variable does not exist, the call to {{getenv()}} returns a null pointer.  In these cases, the call to {{strdup()}} should also return a null pointer, but it is important to verify this as this behavior is not guaranteed by POSIX \[[Open Group 04|AA. C References#Open Group 04]\]

If the TMP environmental variable returns does not exist, the call to getenv() returns NULL. In these cases, the call to strdup() should also return NULL, but it is important to verify this as this behavior is not guaranteed by POSIX OpenGroup 05

Compliant Solution

This compliant solution is fully portable.

Code Block

bgColor	#ccccff

char *tmpvar;
char *tempvar;
char *temp;

if ( (tmpvartemp = getenv("HITMP")) != NULL) {
  hivar tmpvar= malloc(strlen(tmpvartemp)+1);
  if (hivartmpvar != NULL) {
    strcpy(hivartmpvar, tmpvartemp);
  }
  else {
    /* handle error condition */
   printf("HI = %s.\n", hivar}
}
else {
  return -1;
}

if ( (temp = getenv("TEMP")) != NULL) {
  tempvar= malloc(strlen(temp)+1);
  if (tempvar != NULL) {
    strcpy(tempvar, temp);
  }
  else {
    /* handle error condition */
  }
}
else {
  puts("HI not definedreturn -1;
}

if (strcmp(tmpvar, tempvar) == 0) {
  puts("TMP and TEMP are the same.\n");
}
else {
  puts("TMP and TEMP are NOT the same.\n");    
}

Risk Assessment

Rule	Severity	Likelihood	Remediation Cost	Priority	Level
ENV00-A	1 (low)	1 (low)	2 (medium)	P8	L2

...

Space shortcuts

Page tree

Versions Compared

Old Version 12

New Version 13

Key

Compliant Solution (Windows)

Compliant Solution

Risk Assessment